Developer Platform
Build on OneBookPlus
OneBookPlus offers a REST API and webhooks for invoicing, bookings, CRM, jobs, and accounting, purpose-built for Australian SME workflows, with GST-compliant invoices and tenant-scoped API keys.
In the ATO Digital Service Provider onboarding programme (DSPPT-49533)
REST API
Core resources are accessible via a versioned JSON API. Authenticate with scoped API keys, paginate with cursors, filter with query parameters, and sync incrementally with updated_since. The endpoint-by-endpoint schema tables live in the full API reference.
curl https://onebookplus.com.au/api/v1/invoices?limit=50 \
-H "Authorization: Bearer obp_..." \
-H "Content-Type: application/json"{
"data": [
{
"id": "0f6b2c1e-...",
"invoice_number": "INV-0042",
"contact_id": "9a41d7f3-...",
"status": "sent",
"issue_date": "2026-03-25",
"due_date": "2026-04-15",
"total": 1320.00,
"currency": "AUD",
"paid_at": null,
"created_at": "2026-03-25T01:23:44Z",
"updated_at": "2026-03-25T01:23:44Z"
}
],
"next_cursor": "6d0a9b2f-..."
}Available Endpoints
Every operation in the published v1 spec, listed from the spec itself. Successful responses wrap payloads in data (lists add next_cursor); failures return an error body. Schema tables for each endpoint are in the API reference.
/api/v1/ping
Verify API key and connectivity
/api/v1/contacts
List contacts
/api/v1/contacts
Create a contact
/api/v1/contacts/{id}
Get a contact
/api/v1/contacts/{id}
Update a contact
/api/v1/contacts/{id}
Soft-delete a contact
/api/v1/invoices
List invoices
/api/v1/invoices/{id}
Get an invoice
/api/v1/bookings
List bookings
/api/v1/bookings
Create a booking
/api/v1/bookings/{id}
Get a booking
/api/v1/bookings/{id}
Update a booking
/api/v1/quotes
List quotes
/api/v1/quotes
Create a quote
/api/v1/quotes/{id}
Get a quote
/api/v1/quotes/{id}
Update a quote
/api/v1/jobs
List jobs
/api/v1/jobs
Create a job
/api/v1/jobs/{id}
Get a job
/api/v1/jobs/{id}
Update a job
/api/v1/webhooks
List webhook subscriptions
/api/v1/webhooks
Create a webhook subscription
/api/v1/webhooks/{id}
Get a webhook subscription
/api/v1/webhooks/{id}
Update a webhook subscription
/api/v1/webhooks/{id}
Delete a webhook subscription (unsubscribe)
Authentication
Every request is authenticated with a bearer API key scoped to your tenant. Keys are created in your dashboard and can be revoked at any time.
- Tenant-scoped: each key is bound to a single business account
- Read & write scopes: grant only the permissions your integration needs
- Instant revocation: disable a compromised key in one click
Authorization: Bearer obp_k3x7...
# Keys carry the obp_ prefix and are issued at
# Settings -> API keys in your dashboard.
# Scopes: read, or read + write.Webhooks
Subscribe to real-time event notifications. We POST an HMAC-SHA256-signed JSON payload to your endpoint whenever something happens in your account, record every delivery in a log you can inspect and replay, and retry failures with exponential backoff. Manage subscriptions with the free Webhooks app.
invoice.createdFired when an invoice is createdinvoice.sentFired when an invoice is sentinvoice.paidFired when an invoice is marked as paidinvoice.voidedFired when an invoice is voidedinvoice.refundedFired when an invoice is refundedinvoice.updatedFired when an invoice is updatedquote.createdFired when a quote is createdquote.acceptedFired when a client accepts a quotequote.updatedFired when a quote is updatedbooking.createdFired when a booking is createdbooking.cancelledFired when a booking is cancelledbooking.updatedFired when a booking is updatedjob.createdFired when a job is createdjob.scheduledFired when a job is scheduledjob.completedFired when a job is completedjob.updatedFired when a job is updatedcontact.createdFired when a contact is createdcontact.updatedFired when a contact is updatedcontact.deletedFired when a contact is deletedpayment.succeededFired when a payment succeedsinvoice.resentFired when an invoice email is re-sentquote.declinedFired when a client declines a quotestay.createdFired when a hotel stay is createdstay.confirmedFired when a hotel stay is confirmedstay.checked_inFired when a hotel stay is checked instay.checked_outFired when a hotel stay is checked outstay.cancelledFired when a hotel stay is cancelledstay.no_showFired when a hotel stay is marked a no-showPOST https://example.com/your-endpoint
X-OBP-Event: invoice.paid
X-OBP-Signature: sha256=9f2c4a...
{
"event": "invoice.paid",
"data": {
"id": "0f6b2c1e-...",
"invoice_number": "INV-0042",
"total": 1320.00,
"paid_at": "2026-03-25T01:23:40Z"
},
"delivered_at": "2026-03-25T01:23:44Z",
"tenant_id": "b1a2c3d4-..."
}Rate Limiting
Standard rate limits ensure fair usage across all tenants. Limits are applied per API key and returned in response headers.
Standard
60 req/min
Default limit per API key
Write endpoints
20-30 req/min
Per-endpoint caps on create/update calls
Webhooks
5 retries
Backoff from 1 min to 4 h; paused after 10 straight failures
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 87
X-RateLimit-Reset: 1711339424Coming Soon
We're actively expanding the developer platform. Here's what's next on the roadmap.
TypeScript SDK
Fully typed client library with auto-generated types from our OpenAPI spec.
API Playground
Interactive explorer to test endpoints against your sandbox data in the browser.
OAuth 2.0 Flows
Third-party app authorization so your users can connect their OneBookPlus accounts.
Developer FAQ
Common questions about the OneBookPlus REST API, authentication, webhooks, and rate limits.
Does OneBookPlus have an API?
Yes. OneBookPlus exposes a versioned REST API over JSON for contacts, invoices, quotes, and bookings, plus a ping endpoint for connectivity checks. Every request is authenticated with a bearer API key scoped to one business account, list responses use a consistent data/next_cursor envelope, and webhooks deliver signed event notifications. The full endpoint reference is published at /developers/api, and the machine-readable OpenAPI 3.1 spec at /api/v1/openapi.json. API access requires developer-access approval, contact the team to get set up.
How do I authenticate with the OneBookPlus API?
Authenticate with a bearer API key scoped to your business account. Keys use the obp_ prefix, are created in your dashboard under Settings then API keys, can be granted read or read-write scopes, and can be revoked in one click. Keys that opt in to signed requests also carry an HMAC signing secret for write calls.
What are the OneBookPlus API rate limits?
The default limit is 60 requests per minute per API key, with tighter per-endpoint caps on write operations (for example, invoice and quote writes are capped at 20 per minute). Current usage is returned in the X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset response headers, and 429 responses include a Retry-After header.
Does OneBookPlus support webhooks?
Yes. OneBookPlus POSTs an HMAC-SHA256-signed JSON payload (X-OBP-Signature header) to your endpoint for events across invoices, quotes, bookings, contacts, payments, and hotel stays, for example invoice.paid, quote.accepted, booking.cancelled, and contact.created. Failed deliveries are retried up to five times with exponential backoff from 1 minute out to 4 hours, every delivery is recorded in a log you can inspect and replay from the dashboard, and an endpoint that fails 10 times in a row is automatically paused.
Ready to integrate?
API access is currently available on request. Get in touch and we'll set you up with sandbox credentials and documentation.
Reviewed by Bishal Shrestha